---
title: "Create card"
method: POST
path: "/cards"
tags: ["Card"]
---

# Create card

`POST /cards`

Create a new virtual card.

## Request body

- object
  - `exp_month` string — Two digit (MM) expiry month. If neither `exp_month` nor `exp_year` is provided, an expiration date will be generated.
  - `exp_year` string — Four digit (yyyy) expiry year. If neither `exp_month` nor `exp_year` is provided, an expiration date will be generated.
  - `funding_token` string, uuid — The token for the desired `FundingAccount` to use when making transactions with this card.
  - `memo` string — Friendly name to identify the card.
  - `spend_limit` integer — Amount (in cents) to limit approved authorizations. Transaction requests above the spend limit will be declined.
  - `spend_limit_duration` 'ANNUALLY' | 'FOREVER' | 'MONTHLY' | 'TRANSACTION' — Spend limit duration values: * `ANNUALLY` - Card will authorize transactions up to spend limit in a calendar year. * `FOREVER` - Card will authorize only up to spend limit for the entire lifetime of the card. * `MONTHLY` - Card will authorize transactions up to spend limit for the trailing month. Month is calculated as this calendar date one month prior. * `TRANSACTION` - Card will authorizate multiple transactions if each individual transaction is under the spend limit.
  - `state` 'OPEN' | 'PAUSED' — Card state values: * `OPEN` - Card will approve authorizations (if they match card and account parameters). * `PAUSED` - Card will decline authorizations, but can be resumed at a later time.
  - `type` 'DIGITAL_WALLET' | 'MERCHANT_LOCKED' | 'SINGLE_USE' | 'UNLOCKED', required — Card types: * `DIGITAL_WALLET` - Cards that can be provisioned to a digital wallet like Google Pay or Apple Wallet. A subscription is required to create these cards. * `MERCHANT_LOCKED` - Card is locked to first merchant that successfully authorizes the card. * `SINGLE_USE` - Card will close shortly after the first transaction. * `UNLOCKED` - Card will authorize at any merchant. Creating these cards requires additional privileges.

## Response `200`

OK

- FullCard
  - `created` string, date-time, required — An ISO 8601 timestamp for when the card was created. UTC time zone.
  - `exp_month` string — Two digit (MM) expiry month.
  - `exp_year` string — Four digit (yyyy) expiry year.
  - `funding` FundingAccount, required
    - `account_name` string — Account name identifying the funding source. This may be `null`.
    - `created` string, date-time, required — An ISO 8601 string representing when this funding source was added to the Privacy account. This may be `null`. UTC time zone.
    - `last_four` string, required — The last 4 digits of the account (e.g. bank account, debit card) associated with this FundingAccount. This may be null.
    - `nickname` string — The nickname given to the `FundingAccount` or `null` if it has no nickname.
    - `state` 'ENABLED' | 'PENDING', required — State of funding source. Funding source states: * `ENABLED` - The funding account is available to use for card creation and transactions. * `PENDING` - The funding account is still being verified e.g. bank micro-deposits verification.
    - `token` string, uuid, required — A globally unique identifier for this FundingAccount.
    - `type` 'DEPOSITORY_CHECKING' | 'DEPOSITORY_SAVINGS', required — Types of funding source: * `DEPOSITORY_CHECKING` - Bank checking account. * `DEPOSITORY_SAVINGS` - Bank savings account.
  - `hostname` string — Hostname of card's locked merchant (will be empty if not applicable).
  - `last_four` string, required — Last four digits of the card number.
  - `memo` string — Friendly name to identify the card.
  - `spend_limit` integer, required — Amount (in cents) to limit approved authorizations. Transaction requests above the spend limit will be declined.
  - `spend_limit_duration` 'ANNUALLY' | 'FOREVER' | 'MONTHLY' | 'TRANSACTION', required — Spend limit duration values: * `ANNUALLY` - Card will authorize transactions up to spend limit in a calendar year. * `FOREVER` - Card will authorize only up to spend limit for the entire lifetime of the card. * `MONTHLY` - Card will authorize transactions up to spend limit for the trailing month. Month is calculated as this calendar date one month prior. * `TRANSACTION` - Card will authorizate multiple transactions if each individual transaction is under the spend limit.
  - `state` 'CLOSED' | 'OPEN' | 'PAUSED', required — Card state values: * `CLOSED` - Card will no longer approve authorizations. Closing a card cannot be undone. * `OPEN` - Card will approve authorizations (if they match card and account parameters). * `PAUSED` - Card will decline authorizations, but can be resumed at a later time.
  - `token` string, uuid, required — Globally unique identifier.
  - `type` 'DIGITAL_WALLET' | 'MERCHANT_LOCKED' | 'SINGLE_USE' | 'UNLOCKED', required — Card types: * `DIGITAL_WALLET` - Cards that can be provisioned to a digital wallet like Google Pay or Apple Wallet. * `MERCHANT_LOCKED` - Card is locked to first merchant that successfully authorizes the card. * `SINGLE_USE` - Card will close shortly after the first transaction. * `UNLOCKED` - Card will authorize at any merchant. Creating these cards requires additional privileges.
  - `cvv` string — Three digit cvv printed on the back of the card.
  - `pan` string — Primary Account Number (PAN) (i.e. the card number).

## Other responses

- `400` — A parameter in the query given in the request does not match the valid queries for the endpoint.
- `401` — | | | |---|---| | User has not been authenticated | Invalid or missing API key | | API key is not active | The API key used is no longer active | | Could not find API key | The API key provided is not associated with any user | | Please provide API key in Authorization header | The Authorization header is not in the request | | Please provide API key in the form Authorization: api-key [api-key] | The Authorization header is not formatted properly | | Insufficient privileges. Issuing API key required | Write access requires an Issuing API key. Please contact [api@privacy.com](mailto:api@privacy.com) | | Insufficient privileges to create unlocked cards. | Creating unlocked cards requires an additional privilege | Please contact [api@privacy.com](mailto:api@privacy.com) |
- `422` — Unprocessable entity.
- `429` — Client has exceeded the number of allowed requests in a given time period. | | | |---|---| | Rate limited, too many requests per second | User has exceeded their per second rate limit | | Rate limited, reached daily limit | User has exceeded their daily rate limit | | Rate limited, too many keys tried | One IP has queried too many different API keys |

---

[API](https://skmtc.dev/privacy/apis/privacy-developer-api.md) · [All operations](https://skmtc.dev/privacy/apis/privacy-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/privacy/privacy-developer-api/revisions/85ef2cf28e6b/schema)